blackmoon | 37bcfc29102859c4cca259303515b33b41baa8da2a4eaa0e5496b382b4c3a5a9

General

Target

37bcfc29102859c4cca259303515b33b41baa8da2a4eaa0e5496b382b4c3a5a9
Size

4.5MB
Sample

240524-efgzjaca9y
MD5

dacf98048ae2efd28cf29343b86eb178
SHA1

cf241d82813d0d00541565686e39c5d55f58e8db
SHA256

37bcfc29102859c4cca259303515b33b41baa8da2a4eaa0e5496b382b4c3a5a9
SHA512

149442b6b4b1464ef62a5e5d84e26414a08e66ed73b62bd78b6237d4e93057f361187ecd01c18315c8f700ba2946e53f5b040adb01fa97d59ac6dca31241b4ba
SSDEEP

49152:xNIlRFEedDqnroHO8wOZHOlvbuambSIN+6a9AknH:xNI7cnsHtvZHUbmb/+TK

Score

10^/10

Malware Config

Targets

- Target
  
  37bcfc29102859c4cca259303515b33b41baa8da2a4eaa0e5496b382b4c3a5a9
- Size
  
  4.5MB
- MD5
  
  dacf98048ae2efd28cf29343b86eb178
- SHA1
  
  cf241d82813d0d00541565686e39c5d55f58e8db
- SHA256
  
  37bcfc29102859c4cca259303515b33b41baa8da2a4eaa0e5496b382b4c3a5a9
- SHA512
  
  149442b6b4b1464ef62a5e5d84e26414a08e66ed73b62bd78b6237d4e93057f361187ecd01c18315c8f700ba2946e53f5b040adb01fa97d59ac6dca31241b4ba
- SSDEEP
  
  49152:xNIlRFEedDqnroHO8wOZHOlvbuambSIN+6a9AknH:xNI7cnsHtvZHUbmb/+TK
Score

10^/10

blackmoon banker trojan upx discovery
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- Drops file in Drivers directory
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Blackmoon, KrBanker

Detect Blackmoon payload

Drops file in Drivers directory

ACProtect 1.3x - 1.4x DLL software

Checks computer location settings

Loads dropped DLL

UPX packed file

Checks installed software on the system

Enumerates connected drives

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2